# DF-2543 — hw.bus.devices kernel-pointer leak

## Claim
World-readable sysctl `hw.bus.devices` (`sys/kern/subr_bus.c`, `sysctl_devices()`)
copies the raw kernel virtual address of every `device_t` and its parent into
the `dv_handle`/`dv_parent` fields of `struct u_device` (`sys/sys/bus.h`)
returned to userland. Any local user can read it (sysctl framework gates only
writes via SYSCAP, not reads). Defeats KASLR; discloses kernel-heap layout.

## Build
```
cc -O2 -o poc poc.c        # (or ./build.sh)
```

## Run (unprivileged)
```
./poc                      # (or ./run.sh)   as uid 1001 (maxx, NOT in wheel)
```

## Expected
- **Bug present (unpatched #0):** `dv_handle` / `dv_parent` are non-zero
  `0xffff...` kernel pointers for every device; summary reports
  `LEAK CONFIRMED -- N raw kernel pointers disclosed`.
- **Fixed:** `dv_handle == 0 && dv_parent == 0` for every device; summary
  reports `NO LEAK`.

## Notes
- The device tree is enumerated by index: `hw.bus.devices.<generation>.<index>`.
  The generation is read first from `hw.bus.info` (which returns
  `struct u_businfo`).
- `struct u_device` is `bzero`'d before copyout, so this is NOT an
  uninitialized-memory leak — it is the *intentional* pointer fields that leak.